Catalog relay modules - DOLD - #30

Text version of the page

Safety technique 4.3 Control functions in fault situations General requirements Depending on the risk level of the concerned application, suited measures must be taken when failures or malfunction may cause hazardous situa­tions or damages to the machine or production materials. Electrical control circuits must be realized with adequate safety-relevant performance level that was determined by a risk assessment of the machine. The requirements of DIN EN 62061 and/or DIN EN ISO 13849 must be met. Risk minimizing is possible by (not limited to): - Protective equipment on the machine (e.g. SAFEMASTER® STS, emergency stop/switching off equipment, etc.) - Safety interlocking of the electric circuit - Providing of redundancy or diversity in part or completely - Providing of function tests Hazardous situations due to failure or removal of memory contents, e.g. removing batteries, must be prevented. Unauthorized and accidental change of memory contents must be pre-vented by suited means, e.g. use of a key, etc. Use of partial or complete redundancy The use of redundancy can minimize the probability that a single fault can result in a dangerous situation. When it is effective in normal operation it is referred to as online redundance. A conception where specific circuits undertake the safety function only when the operational function fails is referred to as offline redundancy. When offline redundancy is provided, which is not effective during opera­tion, precautions must be taken to ensure that these control circuits will be effective when demanded. Use of diversity Control circuits with different function principles or the use of different components and devices can reduce the probability of hazards due to faults and/or failures. These include, but are not limited to: - NC-NO combinations, actuated by interlocked safety devices - Use of control components of different design - Combination of electro-mechanical and electrical equipment in redun-dant systems A combination of electrical and non-electrical systems (e.g. mechanical, hydraulical, pneumatical) can perform the redundant function and provide for diversity. 4.4 Two-hand circuits In ISO 13851, three types of two-hand circuits are defined that can be used depending on the risk assessment: • Type I: (not suited for the initiation of dangerous operations) - Two control devices, simultaneous actuation by both hands - Continuous and simultaneous actuation during the dangerous opera­tion - Stopping of machine operation when one or both control devices are released and the dangerous situation is still present • Type II: As type I, but both control devices must be released before the machine operation can be restarted. • Type III: As type II, but the simultaneous actuation must be as follows: - Actuation of the control devices within a time of 0.5 sec. - If this time is exceeded, both control devices must be released before the machine operation can be initiated again. 4.5 DIN EN 13850: Safety of machinery Emergency stop, design principles Emergency stop, emergency stop function - Prevent emerging dangers (dangers to persons, damages to machines and production materials) or minimize already existing risks - Must be initiated by a single action of one person. Emergency stop device - Manually actuated control device for initiating an emergency stop func-tion General requirements Emergency stop must be available and functioning at any time and must have priority over other functions and operations in all operating modes of the machine, but without affecting devices that are provided for the rescue of trapped persons. Any start commands must not be able to affect an initiated emergency stop function until the emergency stop function is manually reset. The emergency stop function should be designed as a complementary protective measure and must not be a substitute for protective measures or other safety functions or affect them in their effectiveness. Depending on the risk assessment, the emergency stop function must be designed so that - after actuation of the emergency stop device - dangerous movements and the machine operations are stopped in a suited way with-out causing further hazards and without any intervention by any person. "Suited way" may include: - Selection of an optimal deceleration rate - Selection of the stop category - Application of a defined stopping sequence An emergency stop must be designed so that the decision for actuation does not demand from a person considerations with respect to the effects resulting from this. After operation of an emergency stop device/command, the effect of such a command must be maintained until it is manually reset. A reset must only be done on the location where the emergency stop command has been issued. A restarting must only be possible after a manual reset on this location. The stop category must be selected according to the risk assessment for the machine: • Stop category 0: Stopping by - Immediate interruption of the energy feed to driving components of the machine - Mechanical separation (decoupling) between dangerous parts and their driving component (by braking if necessary) • Stop category 1: Controlled stopping with energy supply to driving components of the machine to achieve a stop, then - after standstill - interruption of the energy supply. Interruption of the energy supply may include: - Disconnecting the energy supply to electric motors of the machine - Disconnecting movable parts of the machine from the source of mechanical energy - Cutting off hydraulic/pneumatical energy sources to a piston/plunger 5 Functional safety - principles of design DIN EN 954-1 Up to November 2009, the standard DIN EN 954-1 could be used parallel with the successor standard DIN EN ISO 13849-1. After that, the standard DIN EN 954 becomes invalid. Required safety-related performance The required safety-related performance is implemented by the use of the standards DIN EN ISO 13849 or DIN EN 62061 and determined and defined in form of a system and risk analysis. For each detected danger, a safety function including validation must be specified. These standards provide supporting tools for defining the required safety integrity. 32